Concepts

Sensitive data

Every request is inspected in flight for credentials and personal data. What's found is attributed, masked at capture, and never stored raw.

How it works

  1. Inline inspection. As each request passes through the gateway, Sovereign inspects its messages, system prompts and tool results, before any model sees them.
  2. High-precision detection. Purpose-built detectors for provider and cloud credentials, checksum-validated card numbers, social security numbers, email addresses and phone numbers.
  3. Conversation-aware counting. Sovereign tracks each conversation, so a value is counted when it first appears, not every time an agent resends its history.
  4. Masked at capture. Only a masked sample is kept, like •••• 4242 or j•••@example.com. Raw values never touch disk: the conversation record and model replies Sovereign keeps are redacted the same way.
  5. Attributed and auditable. Every detection carries who sent it, their team, where in the request it was, and the conversation it belongs to.

The Sensitive data page: detections by kind and by person

What is detected

Kind Examples
API keys and secrets OpenAI, Anthropic and Sovereign keys; AWS, GitHub, Slack and Google credentials; private keys
Card numbers payment card numbers that pass a checksum
SSNs US social security numbers
Email addresses any address
Phone numbers with or without a country code

Policy-aware routing

A team's policy can keep requests that carry secrets, card numbers or SSNs on the models your company approves for that data: Sovereign's routing honors it on every request, including when it falls back to another model. Talk to us to set one up for your teams.

What reaches the model

Requests are delivered as they were sent: detection never edits what your people and apps send. The Sensitive data page shows what was sent, by whom, most recent first, so you can follow up where it matters.